Detection rules › By event

M365-ExchangeItemGroup

Event	Rules
HardDelete	6
MoveToDeletedItems	1
SoftDelete	3

HardDelete

6 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070, T1070.008, T1098, T1098.005

Splunk (5)

O365 Email Hard Delete Excessive Volume severity low T1070, T1070.008, T1485
O365 Email Password and Payroll Compromise Behavior severity medium T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Receive and Hard Delete Takeover Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Exfiltration Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485

MoveToDeletedItems

1 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070, T1070.008, T1098, T1098.005

SoftDelete

3 detection rules reference this event. View event page.

Elastic (1)

M365 Exchange MFA Notification Email Deleted or Moved severity low T1070, T1070.008, T1098, T1098.005

Splunk (2)

O365 Email Password and Payroll Compromise Behavior severity medium T1070, T1070.008, T1114, T1114.001, T1485
O365 Email Send and Hard Delete Suspicious Behavior severity low T1070, T1070.008, T1114, T1114.001, T1485